Privacy Policy 隐私政策

Nommi is a mobile application for recipe management, meal planning, pantry tracking and nutrition ("the App"), published by its independent developer, Chua ("we", "us"). This Privacy Policy describes what information the App and this website process, why, and what choices you have.

We try to collect as little as possible. Many Nommi features run entirely on your device, and no account is required for them. The main cases in which information leaves your device are: (a) optional Smart Import AI processing, (b) optional purchases, and (c) optional iCloud sync handled by Apple under your own Apple account.

This policy covers the Nommi iOS App and the nommi website. It does not cover third-party services' own practices when they act as independent controllers — for example Apple (iCloud, App Store, Apple Health, Sign in with Apple) or your AI providers' handling described in their own policies linked in Section 5.

3.1 Stays on your device (not sent to us)

• App content you create: recipes, meal plans, pantry batches, shopping items and nutrition records. These are stored locally on your device.
• Photos you import for on-device OCR: when you use the offline photo-to-recipe import, recognition runs on your device; the photo is not uploaded to us.

3.2 Sent to us or our processors (only when you use the related feature)

• Smart Import content: photos or webpage content you explicitly select for AI processing (Section 5).
• Account identifier: if you sign in with Apple, we receive a private, pseudonymous Apple identifier (no name or email is required; a private relay email may be provided by Apple if you choose).
• Purchase records: transaction identifiers and credit balance data associated with your purchases (Section 7).
• Cloud drafts: drafts produced by Smart Import, stored temporarily in the cloud (Section 5).

We do not collect advertising identifiers, precise location, contacts, or browsing history, and the App contains no third-party advertising or analytics SDKs.

By default, all app content is stored locally on your device. If you enable iCloud sync, that sync is performed by Apple under your Apple ID and Apple's privacy terms; we do not receive a copy of your synced content. If you use Smart Import with an Apple account, your remaining import credits and recent cloud drafts are tied to that account so they can follow you across devices.

Smart Import converts a photo (for example a recipe card or a grocery receipt) or the content of a public webpage into an editable draft. To do this:

• Only the content you explicitly select (bounded images up to 3 MB and the webpage text) is sent from the App to our cloud backend hosted on Supabase, which forwards it to our AI model providers DeepSeek and Alibaba Cloud for processing.
• Smart Import requires your explicit consent before first use. You can withdraw consent at any time in Smart Import settings; withdrawing consent blocks future imports.
• We do not retain your original photos. Generated drafts are stored in the cloud only temporarily and become unavailable 24 hours after creation; automated cleanup removes the payloads.
• The AI uses this content only to create your draft. Nothing is saved into your recipes or inventory until you confirm it in the App.
• Local OCR and manual import never consume cloud credits and never send content to the cloud.

DeepSeek and Alibaba Cloud act as independent processors with their own privacy policies, which additionally apply: DeepSeek Privacy Policy · Alibaba Cloud Privacy Policy.

At your option, Nommi can read from (and, where supported, write to) Apple Health to track metrics such as hydration or activity. This requires a separate, explicit permission you grant in the system prompt. Health data is processed on your device to display insights and never leaves your device through us. You can review and revoke permissions at any time in the Health app under your profile → Privacy → Apps and Services → Nommi.

Smart Import capacity is sold as a one-time consumable pack (30 imports) through Apple In-App Purchase. Payments are charged by Apple; we never see your payment card details.

• Purchases are validated through RevenueCat, which processes transaction identifiers and store receipts to confirm entitlements and to reconcile purchases, refunds and chargebacks.
• We keep financial records of purchases (store, transaction ID, granted credits, refunds) associated with your pseudonymous account identifier, as required for accounting, tax, fraud prevention and dispute resolution. If you delete your account, these records are disassociated from you (Section 14).
• Purchased credits do not expire. Refunds are handled under Apple's refund policy; a refund may subtract the originally granted credits.
• Guest trial: without an account you may receive a small one-time trial grant. To prevent repeated re-claiming of free trials (trial abuse), we retain a pseudonymous marker — a keyed hash (HMAC) that cannot be reversed to identify you — after account deletion or reinstall. This marker contains no name, email or device content.

We process personal data only for these purposes:

• Providing the App and its features (performance of a contract): local functionality, generating Smart Import drafts you request, syncing credits across your devices when you sign in.
• AI processing of selected content (consent, withdrawable at any time).
• Purchases, accounting and fraud prevention (contract and legitimate interests, and compliance with legal obligations).
• Security, abuse prevention and service integrity (legitimate interests): rate limits, trial-abuse prevention.
• Account deletion requests (contract and legal obligations).

We do not sell or share personal data for cross-context behavioral advertising, and we do not use personal data for profiling that produces legal or similarly significant effects.

We share information only with the following categories of processors, each bound by data-protection agreements:

• Supabase — cloud backend hosting (authentication, database and edge functions for Smart Import and account services).
• DeepSeek and Alibaba Cloud — AI model providers that process Smart Import content to produce drafts (see Section 5).
• RevenueCat — purchase validation and subscription/purchase infrastructure.
• Apple — In-App Purchase, Sign in with Apple, iCloud sync and Apple Health operate under your Apple account and Apple's own privacy policy.

We may also disclose information where required by law, and we will challenge overbroad or unlawful requests where possible.

Nommi is distributed worldwide. When you use features that involve our cloud backend, your information may be processed in the United States, in the Chinese mainland (where our AI providers DeepSeek and Alibaba Cloud process Smart Import content) and in other countries and regions where our processors operate — places that may not provide the same level of protection as your own. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum / Swiss annexes where applicable). By using these features you understand this transfer takes place; you can avoid it entirely by not using Smart Import or purchases.

• Local content: kept on your device until you delete it or uninstall the App.
• Cloud drafts: automatically deleted (made unavailable) 24 hours after creation.
• Original photos for Smart Import: not retained.
• Account data and credit balances: kept while your account exists; deleted with your account (see Section 14).
• Financial records: kept for the period required by accounting and tax law, in disassociated form after account deletion.
• Pseudonymous trial marker: retained after deletion for trial-abuse prevention (Section 7).

Depending on where you live, you have some or all of the following rights over the personal data we process:

• Access and obtain a copy of your data;
• Rectification of inaccurate data;
• Erasure (deletion) of your data;
• Restriction of or objection to processing;
• Data portability;
• Withdrawal of consent at any time (for example, Smart Import consent);
• Non-discrimination for exercising your rights (including CCPA/CPRA rights to know, delete, and correct);
• The right to lodge a complaint with your local supervisory authority.

Because most of your data stays on your device, deleting content in the App or uninstalling it exercises many of these rights directly. For cloud data, use in-app account deletion (Section 14) or contact us at dev.chua@gmail.com. We respond within the timelines required by applicable law (typically 30 days for GDPR requests and 45 days for CCPA requests).

Nommi is not directed to children under 13 (or the equivalent minimum age in your jurisdiction, such as 16 in parts of the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

You can delete your cloud account inside the App at any time (Settings → account actions). Deletion:

• verifies your identity by re-authentication with Apple;
• revokes the Apple sign-in token;
• deletes your Supabase authentication record and all cloud drafts;
• requests deletion of your RevenueCat customer record; and
• disassociates financial records from your identity.

Two exceptions apply: financial records retained in disassociated form where required by law, and the pseudonymous trial-abuse marker described in Section 7. Data stored locally on your device is not affected by account deletion — uninstall the App to remove it.

Data in transit is encrypted (TLS). Our cloud backend enforces authentication on all user endpoints and database-level access controls; server-side functions are the only components able to write balances. We accept only bounded uploads for Smart Import and rate-limit usage to deter abuse. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and regulators as required by law.

This website is fully static. It sets no tracking or advertising cookies and loads no third-party analytics. The only data it stores is a single language preference in your browser's local storage so the site remembers whether you prefer English or Chinese. You can clear it anytime via your browser settings.

We may update this policy as the App evolves. If a change materially affects your rights, we will announce it in the App or on this website before it takes effect, and update the effective date above. Material changes to Smart Import processing also require a new in-app consent.

Chua — independent developer and operator of record
Privacy questions, requests and general support: dev.chua@gmail.com

We aim to reply to all privacy requests within 30 days.